1 files changed, 6 insertions, 4 deletions

diff --git a/fs/namespace.c b/fs/namespace.c
index 79bd8a46e1e7..2fa9fdf7d6f5 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -40,7 +40,7 @@ static inline int sysfs_init(void)
  __cacheline_aligned_in_smp DEFINE_SPINLOCK(vfsmount_lock);
 
 static struct list_head *mount_hashtable;
-static int hash_mask, hash_bits;
+static int hash_mask __read_mostly, hash_bits __read_mostly;
 static kmem_cache_t *mnt_cache; 
 
 static inline unsigned long hash(struct vfsmount *mnt, struct dentry *dentry)
@@ -537,7 +537,6 @@ lives_below_in_same_fs(struct dentry *d, struct dentry *dentry)
 static struct vfsmount *copy_tree(struct vfsmount *mnt, struct dentry *dentry)
 {
         struct vfsmount *res, *p, *q, *r, *s;
-        struct list_head *h;
         struct nameidata nd;
 
         res = q = clone_mnt(mnt, dentry);
@@ -546,8 +545,7 @@ static struct vfsmount *copy_tree(struct vfsmount *mnt, struct dentry *dentry)
         q->mnt_mountpoint = mnt->mnt_mountpoint;
 
         p = mnt;
-        for (h = mnt->mnt_mounts.next; h != &mnt->mnt_mounts; h = h->next) {
-                r = list_entry(h, struct vfsmount, mnt_child);
+        list_for_each_entry(r, &mnt->mnt_mounts, mnt_child) {
                 if (!lives_below_in_same_fs(r->mnt_mountpoint, dentry))
                         continue;
 
@@ -1334,8 +1332,12 @@ asmlinkage long sys_pivot_root(const char __user *new_root, const char __user *p
         error = -EINVAL;
         if (user_nd.mnt->mnt_root != user_nd.dentry)
                 goto out2; /* not a mountpoint */
+        if (user_nd.mnt->mnt_parent == user_nd.mnt)
+                goto out2; /* not attached */
         if (new_nd.mnt->mnt_root != new_nd.dentry)
                 goto out2; /* not a mountpoint */
+        if (new_nd.mnt->mnt_parent == new_nd.mnt)
+                goto out2; /* not attached */
         tmp = old_nd.mnt; /* make sure we can reach put_old from new_root */
         spin_lock(&vfsmount_lock);
         if (tmp != new_nd.mnt) {